Remarks 



Claims 26-38 and 41 - 52 are pending in this application. By this amendment 
Claims 26 - 31, 38, and 41 - 45 have been amended Claims 39 and 40 have been canceled 
and new Claims 46 - 52 have been added. An information disclosure statement is enclosed 
herewith. 

Applicant would like to thank the Examiners for the curtsey of conducting an 
interview with one of the co-inventers and their undersigned attorney. Applicant agrees 
with the Examiners interview summery except in two regards. The co-inventor present was 
Eden Shochat and not Amnon Yacoby. Also, the interview was in December, 2009 and not 
January. 

Applicant would also like to thank the Examiner for the detail in which he set forth 
the issues he saw, in his Office Action, and provided guidance as to what he was looking 
for. This helped in focusing the amendments and preparing this entire response. 

Reconsideration of the rejections and informal objections of the Examiner in his 
Office Action is respectfully requested. It is believed that the application as amended 
overcomes both the rejections set forth and has resolved the issues set forth in the 
Examiner's comments in Response to Arguments. Allowance of this application as 
amended is respectfully requested. 



With regard to the Examiner's comment in paragraph 3 of his Office Action, 
Applicant has now made it clear in each claim that the selection of policy is done "without 
human intervention" and that the selection policy is based on "attribute values" at two or 
more agents from said first set of two or more network elements which host agents. 

With regard to the Examiner's comment in paragraph 4 of his Office Action, 
Applicant has changed the word "operation" to "operational", in each claims that is appears, 
to clearly distinguish the claimed subject matter from the "security problem" of Mattila. 

With regard to the Examiner's comment in paragraph 5 of his Office Action, 
Applicant respectfully disagrees with assertion that an operating system is an application. 
Each of these terms have a clear meaning in the art and to interpret claims so that 
"application" can mean "operating system" is not a reasonable interpretation as would be 
understood by one of ordinary skill in this art. 



Examiner's comments in Response to Arguments 




With regard to the Examiner's comment in paragraph 6 of his Office Action, 
Applicant respectfully disagrees with assertion that the term "system crash" needs further 
definition. Not only is this term known in the art but today is even included in dictionaries 
without further explanation 1 . 



Amended Claim 26 (method) and new Claim 49 (system) each define a 
method or system that collects real-time operational information relating to attribute 
values at two or more agents. The agents in the cited e-Security system do not collect 
operational information relating to attribute values. All the e-Security system's agents 
collect is information relating to the occurrence of an "event" without a value. The 
collection of operational information relating to attribute values enables the method and 
system of this invention to distinguish between major and minor deviations from the norm 
and to be able to segregate similar end points whose attribute values are clustered so as to 
be able to group end points of the same type in different categories. E-Security' s system 
just gives a signal indicating that an "event" occurred. Thus, e-Security' s system cannot 
distinguish end points base on the "value" of the event. 

1 From: 

Merriam-Webster Online Dictionary . 2010. 
<http://www.merriam-webster.com/dictionary/crash> 

Main Entry: crash 
Pronunciation: Ykrash\ 
Function: verb 

Etymology: Middle English crasschen 
Date: 15th century 

transitive verb 1 a : to break violently and noisily : SMASH b : to damage (an 
airplane) in landing 

2 a : to cause to make a loud noise <crash the cymbals together> b : to force (as one's 
way) through with loud crashing noises 

3 : to enter or attend without invitation or without paying <crash the party> 

4 : to move toward aggressively (as in fighting for a rebound) <basketball plavers s 
crashmg the boards> 

5 : to cause (a computer system, component, or program) to crash 



The rejections under 35 U.S.C. 103 




On page 1 5 of his Office Action the Examiner asserts that e-Security 
groups network elements based on attribute values and cites to page 10 of the 
document. That reference says no such thing. The reference relates again to only 
the occurrence of an event and not the value. The importance of an event is 
judged by how many network elements respond to the same event. 

Amended Claim 26 (method) and new Claim 49 (system) also require that 
the selection of a policy be done without human intervention. Both e-Security (see page 7) 
and Mattila (see paragraph 0005 ) are systems where the policy is selected by a human 
operator. 

Amended Claim 26 (method) and new Claim 49 (system) also require the 
policy selected based on attribute values of agents from the first set be implemented by 
at least one of the second network elements hosting an agent. This feature is not disclosed 
or suggested by either e-Security or Mattila alone or in combination. 

It is submitted that the subject matter of Claims 26 and 49 are not rendered 
obvious by the above references and there allowance is respectfully requested. 

New dependant Claims 46 and 50 add the limitation that there is also an 
aggregator which is connected to the policy controller and that the aggregator receives 
the real-time operational information instead of or in addition to the policy controller. 
This clearly is not shown or suggested by the references. 




v 

It is submitted that the application as amended is in condition for 
allowance and such allowance is respectfully requested. If the examiner believes 
it would be helpful he can call the undersigned at 908 337 7662. 
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